Examkin

Question

Difficulty: MediumShared Responsibility Model

A healthcare organization stores medical imaging files and patient records in Amazon Simple Storage Service (Amazon S3) buckets. Under the AWS Shared Responsibility Model, which of the following security tasks are the sole responsibility of the customer? (Select TWO.)

  1. Configuring bucket policies and Access Control Lists (ACLs) to restrict access to the bucketsAnswer
  2. Enabling server-side encryption to protect data at rest within the bucketsAnswer
  3. C
    Disposing of decommissioned physical storage drives that hold the data
  4. D
    Managing and updating the virtualization hypervisor layer hosting the storage service
  5. E
    Patching the operating system of the physical servers hosting Amazon S3

Answer

The customer is responsible for configuring bucket policies and Access Control Lists (ACLs) to restrict access, and enabling server-side encryption to protect data at rest.
Under the AWS Shared Responsibility Model, the customer maintains control and responsibility for security 'in' the cloud. For a managed service like Amazon S3, this includes managing data access permissions through bucket policies and Access Control Lists (ACLs), as well as configuring server-side encryption to secure stored data at rest.

Step-by-Step Solution

1
Analyze the service model of Amazon S3.
Amazon S3 is a fully managed cloud object storage service, meaning the physical infrastructure, virtualization, and host operating system are managed by AWS.
Understanding the service type helps delineate where the customer controls settings versus where AWS manages infrastructure.
2
Identify customer-controlled data security settings.
The customer controls who can access the data (via bucket policies and Access Control Lists) and whether the data is encrypted at rest (via server-side encryption configuration).
Under the Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes data protection and access management.
3
Differentiate customer tasks from AWS infrastructure tasks.
Tasks like physical drive disposal, hypervisor management, and server OS patching belong to the infrastructure layer, which AWS secures ('of' the cloud).
Eliminating infrastructure management tasks allows isolating the correct customer-side responsibilities.

Key Concept

Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud (infrastructure, physical hardware, virtualization, and managed service OS patching), while the customer is responsible for security 'in' the cloud (data classification, access management via bucket policies/ACLs, and encryption settings).
Rate this question

Topics

Shared Responsibility Model

More questions from this topic